Data protection advice for companies
Processing personal data responsibly: We support you in data protection processes, responsibilities and a comprehensible data protection management.
Build and further develop data protection management according to ISO/IEC 27701:2025.
Data protection
Data protection consultancy translates requirements for the handling of personal data into concrete processes. Graf von Westerburg supports companies and public organizations in the organization of their data protection management and the practical implementation of their data protection processes.
The focus is, among other things, on the list of processing activities, technical and organisational measures, data protection impact assessments and employee awareness. The specific scope depends on your processing operations, risks and existing structures.
Data protection and information security we agree on ISMS according to ISO 27001 or one of Integrated management system successively. Information about data processing on this website can be found separately in the Privacy Policy.
Our services in data protection consultancy
In one free initial consultation We analyse your specific needs and together identify the requirements of your company. On this basis, we create a tailor-made package of measures that is optimally adapted to your data protection requirements.
Our offer includes:
- Implementation of a Data Protection Management System (DPMS) according to GDPR.
- Consulting and optimisation Your data protection processes.
- Training to promote data protection awareness.
- Industry-specific solutions and data protection impact assessments.
Upon request, we also provide advice and implementation of special requirements, such as: B. the adaptation to industry-specific data protection standards or the preparation of data protection impact assessments.
With our support, you lay the foundation for effective data protection management and strengthen the trust of your customers in the responsible handling of their data.
Their advantages
Benefit from our cooperation
Security
The protection of personal data is at the heart of our work. With a professionally implemented DPMS, you ensure that your data processing complies with the requirements of the GDPR and other data protection laws – and protect yourself against data breaches and their consequences.
Speed
Through proven methods and standardized processes, we identify and close regulatory gaps in your data protection organization efficiently and quickly.
Customer trust
Reliable handling of personal data strengthens the trust of your customers. A transparent and compliant data protection management becomes the basis of long-term and stable business relationships.
Integrative approach
We either integrate the new regulations into your existing documentation systems or provide you with a collaboration platform.
Personal support on site
Unlike many of our competitors, we are personally at your side whenever you need us.
Data protection consulting specialized for your company
We support you in data protection consulting in the implementation of the following Thematic areas:
Our service provides comprehensive corporate data protection for complex business groups. We coordinate the collection and processing of personal data and ensure accurate records across multiple departments, each with their own individual needs. Our expertise ensures that every step taken is in line with today’s laws, allowing you to calmly focus on your core business.
From medical practices and hospitals to pharmacies, laboratories and beyond, the healthcare sector is a complex area that requires special attention when it comes to data protection. We know how delicate this responsibility can be. Compliance with the provisions of Art. 9 GDPR for health-related personal data must be a top priority. Let us help your organization keep up with stringent requirements so you can maintain legal certainty while protecting sensitive patient health data.
Equip your small and medium-sized business with comprehensive data backup services. Our experienced employees ensure that you can easily comply with the regulations, because we offer you tailor-made solutions for your individual business requirements. Trust us with the protection of valuable customer data – we make sure that you comply with the legal regulations!
The valuable contribution that employees make to a company goes hand in hand with the data they generate. Employers can use this employee information for workforce evaluation, tracking and even sensitive personal insights. However, data protection laws must be respected when it comes to the extent to which the different members of a team should have access to certain areas in your database systems. Because many processes that seem harmless can in fact violate the regulations unless appropriate safeguards are put in place beforehand.
The globalization of business processes has created a need for the secure transfer of personal data between countries. As larger companies typically use cloud computing and SMEs take advantage of its potential, international transfer remains a constant obstacle to GDPR compliance – leading to legal difficulties that companies must address in order to remain compliant.
Organizations around the world face complex compliance challenges when it comes to international data protection. From the negotiation of cross-border lawful traffic and the identification of the parties involved in the processing of personal data, to compliance with national laws, contractual agreement on additional rights or obligations and the pursuit of competent supervisory authorities – all these aspects must be taken into account.
An essential step in ensuring that your company complies with data protection requirements is an audit. This high-level review assesses where deficiencies exist and outlines the ideal measures that need to be implemented in order for compliance targets to be achieved. An analysis can reveal gaps in documentation, technical processes or organizational approaches that need to be closed with a view to complying with legal requirements. Existing active business applications may also need to be optimized from the point of view of data security.
From multinationals to local businesses, we are there for all your privacy document creation and customization needs. We assess the needs of each individual company based on its size, structure and industry-specific legal requirements before providing user-friendly templates that are easily customizable to suit everyone’s needs. With our help, you will remain compliant with the regulations and at the same time be able to reconcile your policies with your personal interests. We help you with the customized creation and improvement of data protection documents.
The rights of the data subject, as defined in the General Data Protection Regulation (Art. 15 – 22 GDPR), are a set of rights that natural persons have with regard to their personal data. These rights include the right of access, rectification, erasure and restriction of the processing of personal data. In addition, natural persons may object to the processing of their personal data or request their portability.
With the entry into force of the General Data Protection Regulation (GDPR), it is of paramount importance that companies ensure that their employees are trained in data protection. Art. 39 (1) (b) outlines clear expectations for the training of personnel “in charge of processing data” and ensures that they comply with the provisions of the GDPR. Properly trained employees not only meet regulatory compliance requirements, but also help protect important information – an invaluable asset when it comes to handling personal data of customers in a company.
Process of a data protection consultation and implementation of a data protection management system (DPMS)
Our experienced data protection consultants are very familiar with the legal requirements, risks and optimization potential in the area of data protection of SMEs, companies and authorities. We offer cross-industry consulting, supported by many years of experience in the areas of GDPR, BDSG, healthcare sector, financial services, telecommunications and many other industries. Use our specialized consultancy to ensure that your company meets the legal data protection requirements and acts in compliance with data protection.
1. Setup
We work closely with your management, data protection officers and IT teams to capture the current state of privacy in your organization and identify potential risks. Our goal is to jointly develop an individual data protection concept that is tailored to your industry-specific requirements and the goals of your company – be it compliance with GDPR, ISO/IEC 27701 or other relevant standards.
2. Analysis
Our experienced team analyzes the existing data protection-relevant processes, your IT infrastructure and your organizational structures. In doing so, we identify weaknesses and check to what extent legal requirements are already complied with. A detailed data protection impact assessment (DPIA) assesses and prioritizes possible risks for those affected.
3. Concept
Based on the analysis results, we create a tailor-made data protection concept that describes the relevant measures for ensuring GDPR compliance. The concept includes both organizational and technical approaches and shows various options for implementation. You decide which solution is the best fit for your company.
4. Solution
We support you in the introduction and implementation of a data protection management system (DPMS) that covers all necessary measures – from short-term adjustments to long-term strategic solutions. This includes, among other things, the creation of process directories, the implementation of data protection-compliant processes and the training of your employees. Technical and organizational measures (TOMs) are individually tailored to your requirements.
5. Reporting
Our experts ensure that you are regularly informed about the progress during implementation. We provide you with detailed reports, status updates and documentation to ensure the verifiability of implementation at all times. In this way, weak points can be detected and corrected at an early stage.
6. Advisory services
After the successful implementation, we offer you continuous advice to keep the data protection management system up-to-date and efficient. A regular monitoring and improvement process (CIP) ensures that your DPMS always meets the changing legal requirements and operational conditions. Our consultants are at your side in the long term as strategic partners.
Frequently asked questions about data protection
What is a Data Protection Management System (DPMS)?
A DPMS is a systematic approach to personal data protection. It includes policies, procedures and technologies that an organization implements to ensure compliance with data protection laws such as GDPR and minimize privacy risks.
What is ISO/IEC 27701:2025 and is it an independent standard?
ISO/IEC 27701:2025 describes requirements for a Privacy Information Management System (PIMS) for the responsible handling of personal data. Unlike the previous edition, it can be applied as a stand-alone management system standard.
A connection with an ISMS according to ISO/IEC 27001 remains possible. Source: ISO – ISO/IEC 27701:2025.
How can data protection management and ISMS be combined?
Data protection management and ISMS deal with different, closely related risks. Shared responsibilities, coordinated risk assessments, documented information and internal audits can facilitate cooperation. Data protection-specific requirements for processing operations and the rights of data subjects remain independently taken into account.
We develop the appropriate structure within our ISO 27001 consulting or IMS consultancy services.
What can a certification according to ISO/IEC 27701 prove?
A certification can prove that the tested data protection management system meets the standard requirements. It supports a comprehensible handling of responsibilities, risks and evidence.
A management system certificate is not a blanket guarantee of full GDPR compliance and does not replace the examination of individual processing operations or the necessary data protection assessment.
Is an ISO 27701 certification mandatory?
No, certification is not required by law, but it is a recognized method of demonstrating compliance with data protection standards and laws and strengthening stakeholder trust.
How long does the process of implementing a DPMS take?
The duration depends on the size and complexity of the organization. As a rule, it can take several months to more than one year, depending on the existing level of information security and the data protection measures to be implemented.
What role does management play in the implementation of a DPMS?
Senior management plays a critical role as it sets the strategic direction, provides resources and conveys the importance of data protection within the organization. Without their support, the implementation and maintenance of an effective DPMS is often not possible.
How often should a DPMS be checked?
A DPMS should be reviewed regularly, ideally at least once a year, to ensure that it continues to comply with legal requirements and best practices. In addition, verifications should be carried out following significant changes in processing activities or IT infrastructure.
What are typical challenges when implementing a DPMS?
Challenges often include lack of qualified staff, complexity of integration with existing systems, ensuring ongoing compliance and resistance within the organization to new processes and policies.
How can external consulting help with the implementation of a DPMS?
External consultants bring expertise and experience that can complement internal resources. They help to avoid pitfalls, provide training and assist in developing effective privacy strategies and preparing for certification.
Which data protection principles should be taken into account in a DPMS?
Important data protection principles are data economy, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
What role do data protection impact assessments (DPIA) play in the context of a DPMS?
Data protection impact assessments are critical tools within a DPMS designed to identify and assess potential risks in data processing, especially in new or changed processing activities. DPIAs help organizations take necessary measures to minimize privacy risks before they occur.
How does a DPMS support compliance with the GDPR?
A DPMS supports organizations in systematically fulfilling the requirements of the GDPR. It enables continuous monitoring, management and improvement of privacy practices and processes to ensure compliance and avoid fines or reputational loss.
What is meant by the "right to be forgotten" and how does the DPMS treat it?
The “right to be forgotten” allows individuals to request the deletion of their personal data. A DPMS should include procedures and technologies to handle such requests in an efficient and demonstrable manner, including documentation of deletion processes.
How important is employee training in the context of a DPMS?
Employee training is crucial because privacy measures are only as effective as the staff implementing them. Regular training and awareness raising is necessary to ensure that all employees understand and adhere to the data protection principles.
How should an organization respond to data breaches and what role does the DPMS play?
A DPMS should include clear procedures and guidelines for responding to data breaches, including notifying regulatory authorities and data subjects in accordance with legal requirements. Effective incident management is crucial to minimize damage and be able to react quickly.
How does ISO 27701 certification relate to other data protection standards?
ISO 27701 is compatible and complementary to other data protection standards and frameworks such as GDPR, ISO/IEC 27001 and industry-specific standards. The integration into an existing ISMS facilitates the adaptation to various regulatory requirements.
Which technical and organisational measures should be taken into account in a DPMS?
Technical measures include data encryption, access controls and security audits. Organizational measures include privacy policies, the appointment of a data protection officer and regular reviews of privacy practices.
How can a DPMS be implemented at internationally operating companies?
For international companies, it is important to implement a DPMS that takes into account both global standards and local laws. This can be achieved by developing uniform data protection policies that can be adapted locally and by setting up central data protection teams.
What are the first steps to implementing a DPMS?
The first steps usually include taking stock of existing data processing activities, identifying privacy risks, setting the organization’s privacy goals and policies, and defining roles and responsibilities under the DPMS.
What is a Data Protection Officer (DPO) and what responsibilities does he have?
A Data Protection Officer is a person designated by an organization who is responsible for monitoring and ensuring compliance with data protection laws. A DPO’s main tasks include monitoring the organisation’s data protection practices, raising awareness and training staff on data protection issues, advising on conducting data protection impact assessments, and working with supervisory authorities.
When does a company need to appoint a data protection officer?
A company must appoint a Data Protection Officer if it has its headquarters in the EU and regularly and systematically monitors people on a large scale or if it processes special categories of personal data or data relating to criminal convictions and crimes on a large scale. This requirement may vary depending on the specific laws of a country and the type of data processing that the company performs.
How to select a suitable data protection officer?
An appropriate Data Protection Officer should have extensive knowledge of data protection law and practices. Ideally, the person shall have legal or technical training relevant to the processing and protection of personal data. In addition, integrity and the ability to work independently are important characteristics.
Can a data protection officer be held liable?
As a rule, the Data Protection Officer is not personally liable for data protection violations of the organization. Legal responsibility remains with the organization. However, it is crucial that the DPO performs its duties properly and provides appropriate advice and warning to the organisation. In the event of gross negligence or intentional misconduct, legal action could theoretically be taken against the DPO itself.
How should the communication between the data protection officer and the management be structured?
Communication between the Data Protection Officer and senior management should be clear, open and regular. The DPO should report directly to the highest management level in order to avoid conflicts of interest and ensure that data protection concerns are adequately addressed. It is also important that the Data Protection Officer has the necessary resources to perform his tasks effectively.
Your experts in data protection issues
Whether CISO, CIO, IT manager, IT manager or responsible for data protection – our experienced data protection experts have extensive practical experience and develop tailor-made solutions that are perfectly adapted to the needs of your company.
- Many years of experience in management systems with focus on ISO 9001, 14001, 27001, 27701, 22301 & GDPR
- Advising for DAX & international companies, banks, authorities and the military on information security, data protection, business continuity, quality and environmental management
- Implementation, auditing, certification & optimization of management systems
- ISO 9001 Lead Auditor, ISO 14001 Lead Auditor
- EMAS environmental verifier
- ISO/IEC 27001 Lead Auditor, ISO/IEC 27001 Lead Implementer, ISO 22301 Lead Auditor
- Data protection officer (TÜV), data protection auditor (TÜV).
- Digital Transformation Manager (TÜV), Business Continuity Manager (TÜV).
- PMP, PRINCE2, MSP, ITIL Expert, CISSP, CISSP-ISSAP, CISM
- Development of training materials on IT security, management systems & compliance
- Conference Speaker
Initial consultation free of charge
Do you want a data protection consultancy or would like to introduce a management system for data protection? We operate in Germany, Austria and Switzerland and support you.